When the Protector Is the Threat

The security industry's deepest anxiety — that the tools meant to protect you are themselves the threat — surfaced across multiple stories in recent days, and none of them were subtle.

A DDoS-Mitigation Firm Was Running the DDoS

A Krebs on Security investigation reveals that a Brazilian tech firm selling DDoS protection services was simultaneously operating the botnet conducting sustained, massive attacks against competing network operators. The practical exposure is straightforward: the firm's customers were paying for a shield that the same organization was wielding as a weapon. Attribution in DDoS ecosystems is already murky, but this case illustrates a specific danger of outsourcing volumetric defense to parties whose interests you cannot audit. The incentive structure — sell mitigation, profit from the threat that makes mitigation necessary — is not hard to imagine recurring elsewhere.

Chromium's Unpatched RCE, Now Fully Public

Google accidentally disclosed the technical details of an unpatched Chromium vulnerability that allows JavaScript to continue executing after the browser window is closed — and that background execution is sufficient for remote code execution on the host. Anyone running a Chromium-based browser (Chrome, Edge, Brave) remains exposed. The accidental leak transforms what was a private zero-day into a public one, granting researchers and threat actors equal notice simultaneously. No patch has shipped.

DigiCert's Cascade Into Windows Trust Failure

A single support misstep at DigiCert triggered what Security Now describes as a cascading crisis that briefly invalidated certificates trusted by millions of Windows systems. Microsoft's remediation response reportedly compounded the disruption, leaving critical infrastructure organizations scrambling to restore trust that had simply vanished. Certificate infrastructure is supposed to degrade gracefully; instead it snapped. The episode is a reminder that PKI brittleness is not an academic concern — it surfaces abruptly, at scale, on a timeline nobody controls.

Typosquatting Has Moved Up the Stack

The case for treating typosquatting as a user-education problem has quietly collapsed. A detailed breakdown explains how AI-generated lookalike domains are now being embedded inside third-party scripts running on your own web properties — meaning the end user never makes a typo at all. The script does it for them. Traditional domain-monitoring tools examine first-party assets; the threat has migrated to the third-party layer where visibility is sparse and dwell time is measured in weeks or months before detection.

SHub Forges the OS Prompt; Canvas Falls During Finals

The SHub macOS infostealer has a new variant that uses AppleScript to render a convincing fake system security-update prompt, harvests credentials on acceptance, and installs a persistent backdoor. The attack surface is the user's reflexive trust in operating-system-level UI — a prompt that looks like Apple is, by design, harder to second-guess than a phishing email. Separately, a cyberattack against Canvas — the learning management system used across US higher education — disrupted year-end exams nationwide, forcing institutions to postpone finals mid-season. No exfiltration was required. Availability attacks against single-vendor platforms serving entire sectors are maximally disruptive precisely because there is no fallback.

The common thread across all of this is not sophistication — most of these techniques are not new. It is positioning. A security vendor running the botnet. A certificate authority introducing the failure. A browser trusted to be closed. An OS prompt forged to look legitimate. The most effective attacks recently have not broken through defenses; they have dressed as the defenses themselves.